PCX 


WORLD INTBLL^TUAL FRQ 


:tyoroanizaiion 

luieau 



INTERNATIONAL APPUCATION PUBUSHED UNDER IHE PATENT COOPERATION TOEATY (PCT) 


(51) Inteniational Patent Classification ^ : 
H04L 9/00, 12/56 


A3 


(11) IntemaUonal PubUcation Number: WO 97AM)471 

(43) International Publication Date: 3 January 1997 (03.01 .97) 


(21) International Application Number: PCT/IL96/00017 

(22) International Filing Date: 16 June 1996 (16.06.96) 


(30) Priority Data: 
114182 


15 June 1995 (15.06.95) 


IL 


(60) Parent Application or Grant 
(63) Related by Continuation 
US 

Filed on 


08/168.041 (CIP) 
15 December 1993 (15.12.93) 


(71) Applicant (for all designated States except US): CHECK 
POINT SOFTWARE TECHNOLOGIES LTD. [IL/IL]; Ha- 
tcoraim Building 2, 35 Jabotinsky Street. 5251 1 Ramat Gan 
(XL). 

(72) Inventors; and 

(75) Invenlors^Applicants (for US only): SHWED, Gil PUIL]; 21 
Harcchesh Street. 69699 Tel Aviv (IL). KRAMER. Shlomo 
tlUIL]; 36 Harav Kuk Street, 63302 Tcl Aviv (IL). ZUK, 
Nir tlL/ILJ; 2 Zvi Street. 52504 Ramat Gan (IL). DOGON, 
Gil [II7IL]; 78 Hakidma Street. 46743 Hertzlia (IL). BEN- 
REUVEN. Ehud [ILOL]; 1 1 Arba AraUot Street. 62486 Tel 
Aviv (IL). 


(74) Agent: A^ TALLY EITAN-ZEEV PEARL & CO.; 
House. 22 Maskit Street, 46733 Herzlia (IL). 


Lumir 


(81) Designated States: AL. AM. AT. AU. AZ, BB, BG. BR, BY, 

CA. CH. CN. CZ. DE. DK, EE. ES. R. GB. GE, HU. IL. 
IS, JP, KE. KG. KP, KR, KZ, LK, LR. LS, LT. LU, LV, 
MD, MG. MK. MN, MW, MX, NO, NZ, PL. PT, RO, RU, 
SD. SE, SG. SI. SK, TJ. TM. TO. TT, UA. UG. US. UZ, 
VN, ARIPO patent (KE, LS. MW, SD, SZ, UG), Eurasian 
patent (AM. AZ. BY. KG. KZ. MD, RU, TJ. TM). European 
patent (AT. BE. CH. DE. DK. ES. PI, FR, GB, GR, IE, IT. 
LU, MC, NL. PT. SE). OAPI patent (BP, BJ. CP, CG. CI. 
CM. GA. GN. ML, MR, NE. SN, TD. TG). 


Pubiislied 

With international search report. 
Before the expiration of the time limit for amending the 
claims and to be republished in the event of the receipt of 
amendments, 

(88) Date of publication of tiie international search report: 

6 March 1997 (06.03.97) 


(54) Titie: A SYSTEM FOR SECURING THE FLOW OF AND SELECTIVELY MODIFYING PACKETS IN A COMPUTER 
NETWORK 


1604- 


1606 


HOST 1 


.1600 


RREWALL 1 



1608 


16t0 


FIREWALL 2 


HOST 2 


CA 1 


1602 


1612 


CA 2 


(57) Abstract 

A novel system for controlling the inbound and outbound data paclcet flow in a computer network by which 
private networks can be secured from outside attacks. A user generates a rule base (400) which is converted into a set of 
filter language mstructions where each rule includes a source, destination, service, whether to accept or reject the packet 
and whether to log the event. The filter language instructions are executed on inspection engines (204) on computers 
aclmg as firewalls (124) positioned in the network such that all traffic is forced to pass through the firewall. Packets are 
filtered in accordance with the rule base. The inspection engine acts as a virtual packet filter machine (600) determining 
whether to accept or reject a packet. If a packet is rejected, it is dropped, and if accepted may be modified. Modifications 
performed in accordance with the rule base, may include encryption, decryption, signature generation or verification or 
address translation. 
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Dpub=g'*''" (mod) p 

B= {g"''"' (mod) p} ^""^ (mod) p 
B= {g^"^* (mod) p) (mod) p 
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*gU^o{t5/'<-Y>'x^>'i/ (binding) ^^LTW^ e>?il/\ ^170 
yn f^. V2(om^'^tyr^^^:^-;\^t^y7^^^^-j\^2Xh^:it'{^ 

hT'-^J'^-;^^. lB>«r<^Wa^-5' btCctoT;^^?^^ ^/^tcta^ 

?feb^cfv\ >^^J'^-:^y<—V^-'(n^^:^^yV(Dyr-i\^i!r--;\y(o^ofi:^ 

tc^ffi-r^. y r ^ y^-f^m^^mxiz^v hu-:^^y-^:r.^ h(D-<-i^ 
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DES. FWZ 1, RC4. RC5, IDEA> HJ7°/t'DES^) , Slpty-;/ 
Kl*. lS/cli2^±<D, y-^*5||^fpI|g/j;^2,.>gy||RiOllS-i-{k<^fc*<D 
y s/ KSr^tP (fiP*>DES, FWZl. RC4. RC5. IDEA, h 
y ://l'DE S^) o p< y y K (message digest method 

) (fiP*,MDp< yy K) «L.< li^ ->-fe-i;{?::^^ y 5/ K (message integrity 
method) fi, y-^^S*tf"JfiB^i7'-^»±^||fT-r.5fcJe)(0 1*yt(12iJil±co 
p^yy K*fcf4T/i'=ryXA«:^tf (Bp-feMDS, SHA^) , 'f-9'^±\C\t 
. ^ >;,-fe-i>CO-aj*&tt^-CroBf#/>y'>a (cryptographic hash) <DH-jf«- 

y-;^^5^S;tL.T^^5^-^/-y^^Mii^?^8Sl|-t-5„ h2SrBSS-r'5 7 


o 
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^£;#(c*5V>Tj3ie)*i2)-ir-;/i/3^liRtt. Hinted 2 ocDSiSr^tf. lo|± 
■feyi^a ^fSf-^^bii (session data encryption key) E. 


^ 5 loll-fei/jya Vx— ^{S::^® (session data integrity key) I tffcS, 
R = E+ I 

y-AT-feSo ^©S$(4. Bt^ftp< yj/ Kfi.I>*MDp( y-7 K(Cj;o-C£vSi:$ 

D5te:J;oTS«?^tl. SIG (R) ICioT^^JiS-feyi/B V|i©#^?)5# 

ttl-So -fe-yi/aVRtS IG (R) ©a^-g-i^-arH, JJcV^TMifS^H/c-^-e/ 
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ENC(TC*c) (R + S IG (R) ) 

v^5l8li«r, y-;^ffllJ*s^P>*tS. titoT^&S^^'Jry nc*fL.T^:^|/iBliEAS4^• 
;ie>^^5rt{c/j;5o lie, y-;^;4S9^-^^vi>»c«rS«?i-5rtd»p>, 
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rs/ 7*1 8 0 0) , ^W^^mW7^\1i. y<^yV<D^^-fJS!.U-fnV=if\^<Df'i 
7* (fin*)RPC. UDP. TCP, ICMP^) (C^^^o-C±5 0 , WT<0j;5'i7 
^-/wKSr^^^S, IP*>, mz.^. IP- ID {-Ui^<D7^) , RPC-XI 
D> RPC-PROGNUM. TCP-SEQ. TCP-ACK. UDP-LE 
N, ICMP-TYPE, ICMP-CODE, SO^ I P - P ROTQ-CfoS,, 
ffiltliiA, -trying VT'-^t?:^®! ^Ut/-?<y.y hCDx-^'SlJ^^lvDJSA 

7r»iiBg$*T,5 (;^7's'7'i 8 0 2) o »:v^-e, mdp< y 5/ K^fflv^T/■'s/7 


S I G (A+ I +M) 
8 0 6) . -'^''^y Kc^i&lfs' hSriaip-fSr ttt, -r— t?<D<%^(Ofc*tcag 

ICJ!SCTfTt>4X?)) , 

•m^omi 1 et-j/ h;45^i^Slf[S:ffl^^TUDP-CSUM7-^-;^K^C 
iiJP^tb, <)i:«UDP-CSUM7-f-/WK*S0t?fc5»^l4, 
«iaiL4rfflV'>TUDP-CSUM7-f-;WK{c:, UDP-SPORPSWDP 
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- D P O R T 7 -71/ K>J5 ji*D ^? 

%T^^<D16\fy ^^iUDP-LEN7^-/^KI;:ttlft^F^^5. 

titHt^it^fi (;^r •yT'l 8 0 8) , inttiilToi5t-«$*i.5« 
ENC(E*^) (M) 


8 10). 

|ftfiiA*5/-<>^-;/ KDF^$*-P>^fife$n7ii-tH«^<(:e)''^^^ (^r 9 0 0). 

D C R (E+A) ( E N C (E+A) 

(M) ) 

m^^fy Vf)^^<^y V-^y^t^h^m^fi^ ^7^2/7^1 9 0 4) ^ 

So 

S I G (A+ I +M) 
35feV>"e2oO^^;^5i:v>(ctttSE^n5 (>^7^iyy 1 9 0 8) « ?^:65-g:Lfc» 

rft>fifz.'^k. ^<^y VtmhK^ {y^'ry-:^! 9 1 0) « S«;&5-ifir t^iv^S-g^ 
ti. /^^:y hf^fiSSi^ttS (^r:yyi 9 1 2) o 
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lfe>t>tc2o(D7 7-^■t!>;^--/^K•e^g3il$^^5r-t5'^^^^Ufci^^^y^©7'^ 2/ 

^lll*5||2 O0(C^^cJtTV>5. KO(srttA>;4SJE:<Dji<f4i# (peer) (Dtz. 
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r off fc^i 7 ^ Kfi if (0«;jssff SrS* LT *»Sr* U> * tUc J; o T 7 

r -r ;j— /-W 2 *5 7 r -'H /4» C) ojSJ^^SrSttSiS r t -5® 
(CA) H (fiptjRSASI) coiD-Cfc?,„ ■y-lr-v'JrSCtSfofci: 

i,zmi>tK *<OtirtrCA4:iiBei*lcCAt3j;-3T)S:$ix5SII^:S(t5, SEE 

JC*1-LTI4. CAl (1 6 0 2) iJS, 7r^in?*-/H <0'<— ^'^Mfil ( 
111 6 El) Srfit^-r 


, CAl. fiP*j7T'f iri^;*— /HfflOKSE^ (CA) t^b^C A''jmm^^k1i 
■CV^So rog^ttCAi^MSil D. y-;«.'<-S/:y^<aBB«iS p u bS.O!l P 
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S IG (Sp„b) 

(i, ^-O^r-Y-^l^^-zK BP*)7r'f'i"J'*-/H t'<-i/y^'^IB«i (Sp 
lift *5^Ti^^^# 5 i t (c „ 

roCA;i5#^-t5ti-g-tCtt, loWCAOD^MIittflfeWCAICtSlf t>n5rt/i 


FAX* tLk-Xn^mn-r^- =>.7 fWi^Wt^m I' ^T?S^ ^ 

v^So ^■«-y:>-/W3>-f3L-i? (PC) 2 100(4, iftwofl!S±c^-c{4y y 
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P C e> Kg A o T < 5 1> CO i: ;^/^ -r - t 1 5 o 


■^>[b$tx^(!: tic, ^y^Ti^Vt'^-y^V(OWi(O^X(om{t^^m\t'r^o Mt- 
\'^(D^-^^^m\^^X^y^T>h^m^\ir^o 

;m<Oy'-^mT^i:^TMi^^/\^:/^y^mi!iK ^2 2iatcs^^tiTv^So ^y 

rv^5o (name) , Pf-^^ y :y K. y K. MD y y :y K 

, ^^•>^^7-Ky ys/ K. y--^-<-v^5/>:^^M«is p u b. ii^$nfcx;^7^^ 
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ENC(TB*c) (P) 


^ 3 y-ciftM Ufc i 5 7 r li' /n b 7 r 
i'!>*-/W2 (^2 00) {cmhtl^7'-'$'izmULtzh(DVhi>. y'y^'f>(^ 

o 

S I G (T + P + TB) 
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ENC(TB^> (R+S I G (R) ) 


S 1 G (U + TB) 

\^<^y^Tyvt^y7^'^'^ir-fv^-i^y^'Am^^^\.x\^^fi\i^^^ 
\^\%yr^^^ir-)\^fl^. V^:xi^ h{zmLX^y^7yh\zi:oxmm^ti 


-47- 


TI.^5^'7-f'Ty HcJ:5|giiE^ (CA) j^l (EP*,RSA®) « I D-CfeSo 
S I G (Dp„b) 

«rffl V ^T , ii ixfc-*- y ^ 'I' IBI6<jSi& S-^^-fS r t tc J; o T 

S Att-^{l:^ffi(;:A;'j$ti5„ -<^—'y^v {n\ihy7-<^'>:i-—M <r> 

I PT Ku;^tt, y 7 ^ -Y ^ :i—Jl't^-iy'y ^ ''JimmD p u b tCiffi*;?/^ V 
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»'*$tiri^5„ icD^ v^lcft. PS^{k$ix;fc/N°;^'7-KSU5^*/J5^* 
ENC(T3,,) (P) 

S I G (T + P + TB) 
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Y, P 
Y 

A. P 


US 5,247,693 (BRISTOL) 21 September 1993, coi. A. line 
43-col. 5, line 33. 
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^ ' ^ ^ required addilionat learch fees were timely paid by the applicant, thti international aeareh report covcni ail aeaichablc 
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4. Q No required additional search fecj were timely paid by the applicant. Conseqtien^Iy, ihis huernatJoMl learch itpon ii 
reatricted to the invention ilrst nmnlioned in the claima: it is covered by claimt Not.: 


R«nttrk on Protest The additional search Icca were accompojiicd by the applicant 'a prtitoat 

n No protest accompanied the payment of additional aeareh feea. 
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